Edit tour

Windows Analysis Report
Offer 15492024 15602024.docx.doc

Overview

General Information

Sample name:	Offer 15492024 15602024.docx.doc
Analysis ID:	1446728
MD5:	0d0f500d82551e733eab0fb1060a49da
SHA1:	1e9af5dd484358b007673b0d7f9b85f8ac1a7b6c
SHA256:	d5e214f3096564dfc3e348b6a3ac6aeefed75d785ac7cfab5d3019f67fdbc9be
Tags:	docdocx
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Microsoft Office launches external ms-search protocol handler (WebDAV)

Multi AV Scanner detection for submitted file

Contains an external reference to another file

Document exploit detected (process start blacklist hit)

Office viewer loads remote template

Document misses a certain OLE stream usually present in this Microsoft Office document type

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Suspicious Office Outbound Connections

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 2088 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

AcroRd32.exe (PID: 2512 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding MD5: 2F8D93826B8CBF9290BC57535C7A6817)

RdrCEF.exe (PID: 3168 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 MD5: 326A645391A97C760B60C558A35BB068)

cleanup

Sigma Signatures

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49165, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, Initiated: true, ProcessId: 2088, Protocol: tcp, SourceIp: 104.21.47.128, SourceIsIpv6: false, SourcePort: 80

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 2088, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 2088, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Offer 15492024 15602024.docx.doc

ReversingLabs: Detection: 13%

Source: unknown	HTTPS traffic detected: 172.67.171.37:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.47.128:443 -> 192.168.2.22:49169 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 104.21.47.128:443 -> 192.168.2.22:49170 version: TLS 1.2

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Directory queried: number of queries: 1006

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Source: global traffic	DNS query: name: bot.ax
Source: global traffic	DNS query: name: bot.ax
Source: global traffic	DNS query: name: bot.ax
Source: global traffic	DNS query: name: bot.ax
Source: global traffic	DNS query: name: bot.ax

Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443

Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic	TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic	TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.171.37:80
Source: global traffic	TCP traffic: 172.67.171.37:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.171.37:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.171.37:80
Source: global traffic	TCP traffic: 172.67.171.37:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 172.67.171.37:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 172.67.171.37:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.171.37:80
Source: global traffic	TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.171.37:443
Source: global traffic	TCP traffic: 172.67.171.37:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.47.128:80
Source: global traffic	TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.47.128:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.47.128:80
Source: global traffic	TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.47.128:80
Source: global traffic	TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic	TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 104.21.47.128:443 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 104.21.47.128:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 172.67.171.37:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic	TCP traffic: 104.21.47.128:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 104.21.47.128:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 104.21.47.128:80

Source: Joe Sandbox View	IP Address: 172.67.171.37 172.67.171.37
Source: Joe Sandbox View	IP Address: 104.21.47.128 104.21.47.128

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: global traffic	HTTP traffic detected: GET /hNZdz HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: bot.axConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hNZdz HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: bot.axConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 172.67.171.37:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.47.128:443 -> 192.168.2.22:49169 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E279F50C-91EA-4841-A527-8D9534FAEB24}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /hNZdz HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: bot.axConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hNZdz HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: bot.axConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: bot.ax

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 May 2024 18:41:10 GMTContent-Type: text/html; charset=UTF-8Connection: closeset-cookie: PHPSESSID=ccqb5jblbbpgelnc46rrjjjacs; path=/expires: Thu, 19 Nov 1981 08:52:00 GMTcache-control: no-store, no-cache, must-revalidatepragma: no-cacheCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eWn4AR2JlvSGXIYHhmmkBq4m0b9AN9ruCiuFGW5GrXSo3pf1ytUz5%2F4dXhkqFI2X91%2BaP9fqqSKY%2FAKuo%2FSYodhTojFaZC77pauiNowuecahNqhZ1ofoZWo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88872db6a9cd0f6b-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 May 2024 18:41:17 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeset-cookie: PHPSESSID=8pqa1qkp3733as8k1h92tuc7et; path=/expires: Thu, 19 Nov 1981 08:52:00 GMTcache-control: no-store, no-cache, must-revalidatepragma: no-cachevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zg3sDoZsaDlJ2YKgBtWaci3lH8cInlpxk2SYPdK6Pw2WOmshxm%2BqnEe4zHlQKB1chA1TOG7T4qp7l5mPW3u59W1eb4lj4OQHiv%2BtcaMYWFSUprWjrvffodk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88872dded9010dc7-EWRalt-svc: h3=":443"; ma=86400

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443

Source: unknown

HTTPS traffic detected: 104.21.47.128:443 -> 192.168.2.22:49170 version: TLS 1.2

Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal68.expl.evad.winDOC@18/29@5/3

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$fer 15492024 15602024.docx.doc

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR6BDC.tmp

Jump to behavior

Source: Offer 15492024 15602024.docx.doc	OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc	OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc	OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc	OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc	OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc	OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc	OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc	OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc	OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc	OLE indicator, Word Document stream: true
Source: Offer 15492024 15602024.docx.doc	OLE indicator, Word Document stream: true

Source: Offer 15492024 15602024.docx.doc	OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc	OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc	OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc	OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc	OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc	OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc	OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc	OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc	OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc	OLE document summary: title field not present or empty
Source: Offer 15492024 15602024.docx.doc	OLE document summary: title field not present or empty
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: Offer 15492024 15602024.docx.doc

ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Offer 15492024 15602024.docx.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\Offer 15492024 15602024.docx.doc

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Offer 15492024 15602024.docx.doc	Initial sample: OLE zip file path = word/embeddings/oleObject7.bin
Source: Offer 15492024 15602024.docx.doc	Initial sample: OLE zip file path = word/embeddings/oleObject6.bin
Source: Offer 15492024 15602024.docx.doc	Initial sample: OLE zip file path = word/embeddings/oleObject5.bin
Source: Offer 15492024 15602024.docx.doc	Initial sample: OLE zip file path = word/embeddings/oleObject2.bin
Source: Offer 15492024 15602024.docx.doc	Initial sample: OLE zip file path = word/media/image2.emf
Source: Offer 15492024 15602024.docx.doc	Initial sample: OLE zip file path = word/embeddings/oleObject4.bin
Source: Offer 15492024 15602024.docx.doc	Initial sample: OLE zip file path = word/embeddings/oleObject3.bin
Source: Offer 15492024 15602024.docx.doc	Initial sample: OLE zip file path = word/_rels/settings.xml.rels

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: Offer 15492024 15602024.docx.doc

Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior

Microsoft Office launches external ms-search protocol handler (WebDAV)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: \Device\RdpDr\;:1\bot.ax\DavWWWRoot

Jump to behavior

Contains an external reference to another file

Source: settings.xml.rels

Extracted files from sample: http://bot.ax/hnzdz

Office viewer loads remote template

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Section loaded: netapi32.dll and davhlpr.dll loaded

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Offer 15492024 15602024.docx.doc	Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc	Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc	Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc	Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc	Stream path 'CONTENTS' entropy: 7.91669502048 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc	Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc	Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc	Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc	Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc	Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: Offer 15492024 15602024.docx.doc	Stream path 'CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr	Stream path '_1777980428/CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr	Stream path '_1777980429/CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr	Stream path '_1777980430/CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr	Stream path '_1777980431/CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr	Stream path '_1777980433/CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr	Stream path '_1777980434/CONTENTS' entropy: 7.91669502048 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr	Stream path '_1777980435/CONTENTS' entropy: 7.91598386737 (max. 8.0)
Source: ~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp.0.dr	Stream path '_1777980436/CONTENTS' entropy: 7.91598386737 (max. 8.0)

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Directory queried: number of queries: 1006

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	13 Exploitation for Client Execution	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	11 File and Directory Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	14 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Offer 15492024 15602024.docx.doc	13%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label	Link
https://bot.ax/hNZdz	0%	Avira URL Cloud	safe
http://bot.ax/hNZdz	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bot.ax	104.21.47.128	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bot.ax/hNZdz	false	Avira URL Cloud: safe	unknown
http://bot.ax/hNZdz	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.171.37	unknown	United States		13335	CLOUDFLARENETUS	false
104.21.47.128	bot.ax	United States		13335	CLOUDFLARENETUS	true

Private

IP
192.168.2.255

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446728
Start date and time:	2024-05-23 20:40:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Offer 15492024 15602024.docx.doc
Detection:	MAL
Classification:	mal68.expl.evad.winDOC@18/29@5/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Active ActiveX Object Active ActiveX Object Active ActiveX Object Active ActiveX Object Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WMIADAP.exe
Excluded IPs from analysis (whitelisted): 2.21.22.179, 2.21.22.155, 88.221.168.141
Excluded domains from analysis (whitelisted): ssl.adobe.com.edgekey.net, armmf.adobe.com, acroipm2.adobe.com.edgesuite.net, e4578.dscb.akamaiedge.net, a122.dscd.akamai.net, acroipm2.adobe.com
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
VT rate limit hit for: Offer 15492024 15602024.docx.doc

Simulations

Behavior and APIs

Time	Type	Description
14:41:35	API Interceptor	874x Sleep call for process: AcroRd32.exe modified
14:41:42	API Interceptor	2699x Sleep call for process: RdrCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.171.37	238478-73884745.xls	Get hash	malicious	Unknown	Browse	bot.ax/ULOux
172.67.171.37	Drwg.xls	Get hash	malicious	Unknown	Browse	bot.ax/
104.21.47.128	238478-73884745.xls	Get hash	malicious	Unknown	Browse	bot.ax/ULOux
	Drwg.xls	Get hash	malicious	Unknown	Browse	bot.ax/XByqP
	238478-73884745.xls	Get hash	malicious	Unknown	Browse	bot.ax/ULOux

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bot.ax	238478-73884745.xls	Get hash	malicious	Unknown	Browse	172.67.171.37
	238478-73884745.xls	Get hash	malicious	Unknown	Browse	104.21.47.128
	Drwg.xls	Get hash	malicious	Unknown	Browse	104.21.47.128
	238478-73884745.xls	Get hash	malicious	Unknown	Browse	104.21.47.128
	250-copy.docx	Get hash	malicious	Unknown	Browse	104.21.47.128
	250-copy.docx	Get hash	malicious	Unknown	Browse	104.21.47.128
	Bank Debit Note.docx	Get hash	malicious	Unknown	Browse	104.21.47.128
	Bank Debit Note.docx	Get hash	malicious	Unknown	Browse	104.21.47.128
	ANFRAGE - 0503.docx	Get hash	malicious	Unknown	Browse	172.67.171.37
	ANFRAGE - 0503.docx	Get hash	malicious	Unknown	Browse	172.67.171.37

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	044f.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	QUOTATION_MAYQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	188.114.96.3
	LHER000698175.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	Purchase Order # PO-00159.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	DHL_Delivery Documents.exe	Get hash	malicious	FormBook	Browse	172.67.214.17
	LHER000698175.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	PO 4500025813.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	hesaphareketi-.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Home Purchase Contract and Property Details.xls	Get hash	malicious	Remcos, DBatLoader	Browse	188.114.96.3
	Documents Of DHL -BL- AWB- 8976453410.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
CLOUDFLARENETUS	044f.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	QUOTATION_MAYQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	188.114.96.3
	LHER000698175.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	Purchase Order # PO-00159.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	DHL_Delivery Documents.exe	Get hash	malicious	FormBook	Browse	172.67.214.17
	LHER000698175.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	PO 4500025813.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	hesaphareketi-.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Home Purchase Contract and Property Details.xls	Get hash	malicious	Remcos, DBatLoader	Browse	188.114.96.3
	Documents Of DHL -BL- AWB- 8976453410.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	Home Purchase Contract and Property Details.xls	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.171.37 104.21.47.128
	1080.xls	Get hash	malicious	Unknown	Browse	172.67.171.37 104.21.47.128
	Sipari#U015f detaylar#U0131.xls	Get hash	malicious	Unknown	Browse	172.67.171.37 104.21.47.128
	Drwg.xls	Get hash	malicious	Unknown	Browse	172.67.171.37 104.21.47.128
	Pepsico RFQ_P1005712.xls	Get hash	malicious	GuLoader	Browse	172.67.171.37 104.21.47.128
	ENQUIRY OFFER.xls	Get hash	malicious	FormBook	Browse	172.67.171.37 104.21.47.128
	PHARMACEUTICAL ORDER.xls	Get hash	malicious	Unknown	Browse	172.67.171.37 104.21.47.128
	Plat#U0103 Factura MTL11852.xls	Get hash	malicious	Remcos	Browse	172.67.171.37 104.21.47.128
	PON2401071.xls	Get hash	malicious	Remcos	Browse	172.67.171.37 104.21.47.128
	irlforme.doc	Get hash	malicious	Unknown	Browse	172.67.171.37 104.21.47.128
7dcce5b76c8b17472d024758970a406b	SCB REmittance Advice.doc	Get hash	malicious	Lokibot	Browse	104.21.47.128
	948209184.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	104.21.47.128
	documentos.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	104.21.47.128
	Inventory_Analysis.xls	Get hash	malicious	Unknown	Browse	104.21.47.128
	Inventory_Analysis.xls	Get hash	malicious	Unknown	Browse	104.21.47.128
	PYR0948.doc	Get hash	malicious	Unknown	Browse	104.21.47.128
	New Order.doc	Get hash	malicious	FormBook	Browse	104.21.47.128
	ORDER FB8190311.doc	Get hash	malicious	Lokibot	Browse	104.21.47.128
	1080.xls	Get hash	malicious	Unknown	Browse	104.21.47.128
	20240403_Oferta factory..xls	Get hash	malicious	Unknown	Browse	104.21.47.128

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	292
Entropy (8bit):	5.204701829243891
Encrypted:	false
SSDEEP:	6:DnRyq2PP2nKuAl9OmbnIFUt86nC1Zmw+6nCjRkwOP2nKuAl9OmbjLJ:DRyvWHAahFUt86U/+6qR57HAaSJ
MD5:	209CBF08797FA68AE4D8F81E9F150157
SHA1:	07AA41DFA169A1959DCD3F7AD12FB2188D386587
SHA-256:	5D11937190DC5A9FCE244C786F0CFD35F389FA535DE85CC361B00B89B595DA9B
SHA-512:	DA794EB00D72722034EEF9BD0EF8D1B8301A75B1A716A2EC3DC464AB5F1759B0A0F9A56FFBF6AB39281A6F41DBF406D26FA03389028A08678FFAD82079842D9C
Malicious:	false
Reputation:	low
Preview:	2024/05/23-14:41:45.194 3252 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/05/23-14:41:45.197 3252 Recovering log #3.2024/05/23-14:41:45.199 3252 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.204701829243891
Encrypted:	false
SSDEEP:	6:DnRyq2PP2nKuAl9OmbnIFUt86nC1Zmw+6nCjRkwOP2nKuAl9OmbjLJ:DRyvWHAahFUt86U/+6qR57HAaSJ
MD5:	209CBF08797FA68AE4D8F81E9F150157
SHA1:	07AA41DFA169A1959DCD3F7AD12FB2188D386587
SHA-256:	5D11937190DC5A9FCE244C786F0CFD35F389FA535DE85CC361B00B89B595DA9B
SHA-512:	DA794EB00D72722034EEF9BD0EF8D1B8301A75B1A716A2EC3DC464AB5F1759B0A0F9A56FFBF6AB39281A6F41DBF406D26FA03389028A08678FFAD82079842D9C
Malicious:	false
Reputation:	low
Preview:	2024/05/23-14:41:45.194 3252 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/05/23-14:41:45.197 3252 Recovering log #3.2024/05/23-14:41:45.199 3252 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF510964.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.204701829243891
Encrypted:	false
SSDEEP:	6:DnRyq2PP2nKuAl9OmbnIFUt86nC1Zmw+6nCjRkwOP2nKuAl9OmbjLJ:DRyvWHAahFUt86U/+6qR57HAaSJ
MD5:	209CBF08797FA68AE4D8F81E9F150157
SHA1:	07AA41DFA169A1959DCD3F7AD12FB2188D386587
SHA-256:	5D11937190DC5A9FCE244C786F0CFD35F389FA535DE85CC361B00B89B595DA9B
SHA-512:	DA794EB00D72722034EEF9BD0EF8D1B8301A75B1A716A2EC3DC464AB5F1759B0A0F9A56FFBF6AB39281A6F41DBF406D26FA03389028A08678FFAD82079842D9C
Malicious:	false
Reputation:	low
Preview:	2024/05/23-14:41:45.194 3252 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/05/23-14:41:45.197 3252 Recovering log #3.2024/05/23-14:41:45.199 3252 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.008898238653846898
Encrypted:	false
SSDEEP:	3:ImtVnM1xVlt/rt/l3Sxdlt4dV1gt/lop:IiV0xlzaxdX4m1lo
MD5:	3B8BF2F369CA7ABDF0636EE15DDEF161
SHA1:	4B82D483B79B555C62AA17F31F24F43C38F2C80F
SHA-256:	100201408FDCFA835C8699C6C2FCE748C5C3844C386053F9AA7CAD622373BFCA
SHA-512:	457D92EA15FA528E7BE3ED8136A267BD08A4D7866FDD7C353CFEB898F896983B40BB48156DC25D5E00EC118C6309337F3A9344226D1635F94D7F4A122D3DD87E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	VLnk.....?......LhXJ ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3024000, file counter 15, database pages 15, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	3.5765668006457156
Encrypted:	false
SSDEEP:	384:neh9dThytELJ8DAcLKuZsLRGlKhsvXh+vSc:nAeZsLQhUSc
MD5:	0AA5C4A1554B9EFA75AD1D55EAAFD527
SHA1:	053BFF6B01018BCB12B2767BEB359B8CA464543E
SHA-256:	1019F443060DB309C3340346FF7CDBD8A6A33D71E11E92D490CC080A83041CFF
SHA-512:	57866163515706E36FEFF43513B7D5F2EF9AAD89CB7EA4F3BBAB94D40051369C8AF2FE0A5ABC9CAB400E05A311735CC1C7FE2F41FC1EA66DA03FDC2E2AE9DDD0
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................$.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.312898121228136
Encrypted:	false
SSDEEP:	48:7MDU2iomVmBsmom1CNdiomYiom1Nom1Aiom1RROiom1Com1pom1XSiomVPiomg5Z:7EBCm6rNd9RhLSCPwd49IVXEBodRBk7
MD5:	CAC047F57FD00A43A6748658DD2659AD
SHA1:	E83C13AE333BA25C813CD3989267F9C9A67493BF
SHA-256:	0B8337A4791FD9EC447B90BF6972CB2079EC517565F76E2596676F7FCFEA614A
SHA-512:	F83DF99B84063F7482069DFF9F14B0956C3AB6E91274A98DFBA24D04F2E25F4804D24E2B5FAB105724D84BD10464CE49096272E482981C98EDB0CCC819BD9AAD
Malicious:	false
Reputation:	low
Preview:	.... .c..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................W....X.W.L...y.......~........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	72643
Entropy (8bit):	5.393779678652009
Encrypted:	false
SSDEEP:	768:PCbTjMYOpdyVFWqnPvBRSiRkTIVzY3mXqWHDM2Us5HYyu:AlOpdyVFWcPvBBRkTIdY3unjHK
MD5:	CC471F0BA0AF5790AF5F66770221A6F7
SHA1:	DEF0C722BDBBB15CD1DAE9E533B4A3013D471427
SHA-256:	EC9BC4B13AE566FC978B86F5D7ACB28A535CC9DB2812A308A79B48374138F1C1
SHA-512:	84BC0EA7756A5505DD23F74861626F0A0CE875B406B8BA83437DA7A7A30926AEA64ED5913AC107A6423B22C70A2BAB37B7B9F02BB76B1137BC8F1735F559EAE6
Malicious:	false
Reputation:	low
Preview:	4.458.88.FID.2:o:........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.94.FID.2:o:........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.82.FID.2:o:........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.85.FID.2:o:........:F:Aparajita.P:Aparajita.L:&.........................."F:Aparajita.#.99.FID.2:o:........:F:Aparajita-Italic.P:Aparajita Italic.L:&.........................."F:Aparajita.#.95.FID.2:o:........:F:Aparajita-Bold.P:Aparajita Bold.L:&.........................."F:Aparajita.#.108.FID.2:o:........:F:Aparajita-BoldItalic.P:Aparajita Bold Italic.L:&.........................."F:Aparajita.#.93.FID.2:o:........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.75.FID.2:o:........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.89.FID.2:o:........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.85.FID.2:o:........:F:Arial-BoldMT.P:Arial Bold.L:$....

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD (copy)

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025641896670120692
Encrypted:	false
SSDEEP:	6:I3DPc0YhFvxggLR7fWlgt/1u5FRXv//4tfnRujlw//+GtluJ/eRuj:I3DPgX+lg1uvYg3J/
MD5:	680F359FA02E81BA50C3E8448E96910D
SHA1:	3ADC8B8D9E8AC216FBD9E9EEB1254DD3CD35EEDF
SHA-256:	ED49C5509A30F55AB6122B209D618D82A8EB339CB4B70A6D07387B7A428EDAA9
SHA-512:	8D2DA529F879EC8F049F6A928C433A2AD5538101207E1C0F0FBEF0EAF7696E6FEE6A2AB1A810A32F12F27C8F2B17DCCB64F336B6821BC92268145A43079845DD
Malicious:	false
Reputation:	low
Preview:	......M.eFy...z(.....5F.Q......S,...X.F...Fa.q............................,pJ6...I..`Z..........\r"...}A..b].........................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\hNZdz[1].htm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.43745738033235
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLGWbRIwcWWGu:q43tISl6kXiMIWSU6XlI55bRIpfGu
MD5:	0104C301C5E02BD6148B8703D19B3A73
SHA1:	7436E0B4B1F8C222C38069890B75FA2BAF9CA620
SHA-256:	446A6087825FA73EADB045E5A2E9E2ADF7DF241B571228187728191D961DDA1F
SHA-512:	84427B656A6234A651A6D8285C103645B861A18A6C5AF4ABB5CB4F3BEB5A4F0DF4A74603A0896C7608790FBB886DC40508E92D5709F44DCA05DD46C8316D15BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>cloudflare</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2760287.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1505804
Entropy (8bit):	0.608714479340621
Encrypted:	false
SSDEEP:	768:QncRpbfoTGRFJxqWKAEXM4espeEnwyFwx+VjJ6bGx4Al7PHj8bKYEqQtVxGW6sQR:fRpbfoaRFTqWKP8w9MXIoZfE3NkEs
MD5:	476C7C2F309C957F6428D04E94C4F64A
SHA1:	F1B0FA252BABFB7002DC87069A436AD71BDA532F
SHA-256:	C0DA66B866CC999AEE20456C2EEE3EEFC05046B8F5DF3755F95FECB85F9F8BE5
SHA-512:	C941FBACC6C98B556EA742538B2F2C61A66BE677AA5F97457DFE07EA9652E17FE545AC05740F8ED20B1449FDCF38E97C49FE73FF8D53220A4E8D3E6E3615854E
Malicious:	false
Preview:	....l...........R...I............)...;.. EMF................................8...X....................?...........................................)...;..........S...J...Q...P...........R...I...................S...J...P...(...x........... ....)...;..(...S...J.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4DCE1C90.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1505804
Entropy (8bit):	0.611760173242012
Encrypted:	false
SSDEEP:	768:/jKn4RpbfoTGRFm2GWWDEXM4espe2B/nwyFwx+VjRQ9+c4AgD7PHj8bKYEqQtVxY:/jhRpbfoaRFvGWW6/4DADMXIok/2GiEs
MD5:	D69C22A341E111FEEA69DF6D8C655D60
SHA1:	AC862337F2EFA43627508927F5052CE694012206
SHA-256:	05B2053BF1D070D6034B45CD79B54D80DA3C6D88D016671A345E75048B1A68DB
SHA-512:	D4DB33ED046B3C9BA09C4B3FEAC17B1FE2E75FCE67F4154FD795D504708C295A1E3C8331ED3D6C3EE9950C936C4CC25B5D690558C26F2E1F7771BD5EB275822C
Malicious:	false
Preview:	....l...........R...I............)...;.. EMF................................8...X....................?...........................................)...;..........S...J...Q...P...........R...I...................S...J...P...(...x........... ....)...;..(...S...J.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\642EEADC.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1505804
Entropy (8bit):	0.608714479340621
Encrypted:	false
SSDEEP:	768:QncRpbfoTGRFJxqWKAEXM4espeEnwyFwx+VjJ6bGx4Al7PHj8bKYEqQtVxGW6sQR:fRpbfoaRFTqWKP8w9MXIoZfE3NkEs
MD5:	476C7C2F309C957F6428D04E94C4F64A
SHA1:	F1B0FA252BABFB7002DC87069A436AD71BDA532F
SHA-256:	C0DA66B866CC999AEE20456C2EEE3EEFC05046B8F5DF3755F95FECB85F9F8BE5
SHA-512:	C941FBACC6C98B556EA742538B2F2C61A66BE677AA5F97457DFE07EA9652E17FE545AC05740F8ED20B1449FDCF38E97C49FE73FF8D53220A4E8D3E6E3615854E
Malicious:	false
Preview:	....l...........R...I............)...;.. EMF................................8...X....................?...........................................)...;..........S...J...Q...P...........R...I...................S...J...P...(...x........... ....)...;..(...S...J.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\988D220B.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1505804
Entropy (8bit):	0.608714479340621
Encrypted:	false
SSDEEP:	768:QncRpbfoTGRFJxqWKAEXM4espeEnwyFwx+VjJ6bGx4Al7PHj8bKYEqQtVxGW6sQR:fRpbfoaRFTqWKP8w9MXIoZfE3NkEs
MD5:	476C7C2F309C957F6428D04E94C4F64A
SHA1:	F1B0FA252BABFB7002DC87069A436AD71BDA532F
SHA-256:	C0DA66B866CC999AEE20456C2EEE3EEFC05046B8F5DF3755F95FECB85F9F8BE5
SHA-512:	C941FBACC6C98B556EA742538B2F2C61A66BE677AA5F97457DFE07EA9652E17FE545AC05740F8ED20B1449FDCF38E97C49FE73FF8D53220A4E8D3E6E3615854E
Malicious:	false
Preview:	....l...........R...I............)...;.. EMF................................8...X....................?...........................................)...;..........S...J...Q...P...........R...I...................S...J...P...(...x........... ....)...;..(...S...J.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9D0EA1B2.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1505804
Entropy (8bit):	0.608714479340621
Encrypted:	false
SSDEEP:	768:QncRpbfoTGRFJxqWKAEXM4espeEnwyFwx+VjJ6bGx4Al7PHj8bKYEqQtVxGW6sQR:fRpbfoaRFTqWKP8w9MXIoZfE3NkEs
MD5:	476C7C2F309C957F6428D04E94C4F64A
SHA1:	F1B0FA252BABFB7002DC87069A436AD71BDA532F
SHA-256:	C0DA66B866CC999AEE20456C2EEE3EEFC05046B8F5DF3755F95FECB85F9F8BE5
SHA-512:	C941FBACC6C98B556EA742538B2F2C61A66BE677AA5F97457DFE07EA9652E17FE545AC05740F8ED20B1449FDCF38E97C49FE73FF8D53220A4E8D3E6E3615854E
Malicious:	false
Preview:	....l...........R...I............)...;.. EMF................................8...X....................?...........................................)...;..........S...J...Q...P...........R...I...................S...J...P...(...x........... ....)...;..(...S...J.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9E522104.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1505804
Entropy (8bit):	0.608714479340621
Encrypted:	false
SSDEEP:	768:QncRpbfoTGRFJxqWKAEXM4espeEnwyFwx+VjJ6bGx4Al7PHj8bKYEqQtVxGW6sQR:fRpbfoaRFTqWKP8w9MXIoZfE3NkEs
MD5:	476C7C2F309C957F6428D04E94C4F64A
SHA1:	F1B0FA252BABFB7002DC87069A436AD71BDA532F
SHA-256:	C0DA66B866CC999AEE20456C2EEE3EEFC05046B8F5DF3755F95FECB85F9F8BE5
SHA-512:	C941FBACC6C98B556EA742538B2F2C61A66BE677AA5F97457DFE07EA9652E17FE545AC05740F8ED20B1449FDCF38E97C49FE73FF8D53220A4E8D3E6E3615854E
Malicious:	false
Preview:	....l...........R...I............)...;.. EMF................................8...X....................?...........................................)...;..........S...J...Q...P...........R...I...................S...J...P...(...x........... ....)...;..(...S...J.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9EEE011E.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1505804
Entropy (8bit):	0.608714479340621
Encrypted:	false
SSDEEP:	768:QncRpbfoTGRFJxqWKAEXM4espeEnwyFwx+VjJ6bGx4Al7PHj8bKYEqQtVxGW6sQR:fRpbfoaRFTqWKP8w9MXIoZfE3NkEs
MD5:	476C7C2F309C957F6428D04E94C4F64A
SHA1:	F1B0FA252BABFB7002DC87069A436AD71BDA532F
SHA-256:	C0DA66B866CC999AEE20456C2EEE3EEFC05046B8F5DF3755F95FECB85F9F8BE5
SHA-512:	C941FBACC6C98B556EA742538B2F2C61A66BE677AA5F97457DFE07EA9652E17FE545AC05740F8ED20B1449FDCF38E97C49FE73FF8D53220A4E8D3E6E3615854E
Malicious:	false
Preview:	....l...........R...I............)...;.. EMF................................8...X....................?...........................................)...;..........S...J...Q...P...........R...I...................S...J...P...(...x........... ....)...;..(...S...J.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B771952D.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1505804
Entropy (8bit):	0.608714479340621
Encrypted:	false
SSDEEP:	768:QncRpbfoTGRFJxqWKAEXM4espeEnwyFwx+VjJ6bGx4Al7PHj8bKYEqQtVxGW6sQR:fRpbfoaRFTqWKP8w9MXIoZfE3NkEs
MD5:	476C7C2F309C957F6428D04E94C4F64A
SHA1:	F1B0FA252BABFB7002DC87069A436AD71BDA532F
SHA-256:	C0DA66B866CC999AEE20456C2EEE3EEFC05046B8F5DF3755F95FECB85F9F8BE5
SHA-512:	C941FBACC6C98B556EA742538B2F2C61A66BE677AA5F97457DFE07EA9652E17FE545AC05740F8ED20B1449FDCF38E97C49FE73FF8D53220A4E8D3E6E3615854E
Malicious:	false
Preview:	....l...........R...I............)...;.. EMF................................8...X....................?...........................................)...;..........S...J...Q...P...........R...I...................S...J...P...(...x........... ....)...;..(...S...J.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DCE8D351.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1505804
Entropy (8bit):	0.608714479340621
Encrypted:	false
SSDEEP:	768:QncRpbfoTGRFJxqWKAEXM4espeEnwyFwx+VjJ6bGx4Al7PHj8bKYEqQtVxGW6sQR:fRpbfoaRFTqWKP8w9MXIoZfE3NkEs
MD5:	476C7C2F309C957F6428D04E94C4F64A
SHA1:	F1B0FA252BABFB7002DC87069A436AD71BDA532F
SHA-256:	C0DA66B866CC999AEE20456C2EEE3EEFC05046B8F5DF3755F95FECB85F9F8BE5
SHA-512:	C941FBACC6C98B556EA742538B2F2C61A66BE677AA5F97457DFE07EA9652E17FE545AC05740F8ED20B1449FDCF38E97C49FE73FF8D53220A4E8D3E6E3615854E
Malicious:	false
Preview:	....l...........R...I............)...;.. EMF................................8...X....................?...........................................)...;..........S...J...Q...P...........R...I...................S...J...P...(...x........... ....)...;..(...S...J.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\ED2C6F4F.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1505804
Entropy (8bit):	0.608714479340621
Encrypted:	false
SSDEEP:	768:QncRpbfoTGRFJxqWKAEXM4espeEnwyFwx+VjJ6bGx4Al7PHj8bKYEqQtVxGW6sQR:fRpbfoaRFTqWKP8w9MXIoZfE3NkEs
MD5:	476C7C2F309C957F6428D04E94C4F64A
SHA1:	F1B0FA252BABFB7002DC87069A436AD71BDA532F
SHA-256:	C0DA66B866CC999AEE20456C2EEE3EEFC05046B8F5DF3755F95FECB85F9F8BE5
SHA-512:	C941FBACC6C98B556EA742538B2F2C61A66BE677AA5F97457DFE07EA9652E17FE545AC05740F8ED20B1449FDCF38E97C49FE73FF8D53220A4E8D3E6E3615854E
Malicious:	false
Preview:	....l...........R...I............)...;.. EMF................................8...X....................?...........................................)...;..........S...J...Q...P...........R...I...................S...J...P...(...x........... ....)...;..(...S...J.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FCB74535.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1505804
Entropy (8bit):	0.608714479340621
Encrypted:	false
SSDEEP:	768:QncRpbfoTGRFJxqWKAEXM4espeEnwyFwx+VjJ6bGx4Al7PHj8bKYEqQtVxGW6sQR:fRpbfoaRFTqWKP8w9MXIoZfE3NkEs
MD5:	476C7C2F309C957F6428D04E94C4F64A
SHA1:	F1B0FA252BABFB7002DC87069A436AD71BDA532F
SHA-256:	C0DA66B866CC999AEE20456C2EEE3EEFC05046B8F5DF3755F95FECB85F9F8BE5
SHA-512:	C941FBACC6C98B556EA742538B2F2C61A66BE677AA5F97457DFE07EA9652E17FE545AC05740F8ED20B1449FDCF38E97C49FE73FF8D53220A4E8D3E6E3615854E
Malicious:	false
Preview:	....l...........R...I............)...;.. EMF................................8...X....................?...........................................)...;..........S...J...Q...P...........R...I...................S...J...P...(...x........... ....)...;..(...S...J.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	12779520
Entropy (8bit):	1.2499265779435718
Encrypted:	false
SSDEEP:	24576:pznzhzozczFPzfzXzszxzCzIzRz+z9xzPzJzD9O:pDtEA5PL7AtmkFSJxD99
MD5:	4605356C655CA7364D6DD9016DDD5FC3
SHA1:	42B668EDFEC85967742DC5F00A4E38116BA763DE
SHA-256:	517CF9F4F50865E40AAD4D5804BF0DF75361F5842875C9B5FDC9A7C75DCC48A8
SHA-512:	2736EF61AD54191D355DBE8EA2E57E3D2BF8B7BBA3F9AB070F3747FB9141A338AF4214A0D268370502C0BDD0AF05303EC97862C40CD4558A4F857641304BCE5B
Malicious:	false
Preview:	......................>............................................3..........................}.......\|.......z...............................................................................................N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...............................................................................................x'..y'..z'..{'..\|'..}'..~'...'...'...'...'...'...'...'...'...'...'...'...'...'...'...'...'...'...3...3...3...3...3...3..................B........................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...........D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{25683BA2-9842-415F-8B16-690542B9D4B9}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	2.8231012178638037
Encrypted:	false
SSDEEP:	24:P3oK3oK3oK3oa3oK3oK3oK3mD7bdN1WfK3oK3oK3Q:+PbdN1C
MD5:	69ADAD3B2E8A30194D00F47320939EE3
SHA1:	6CAF57936C807EA0C3A8C1054954EE528B92CEF2
SHA-256:	03A6DC2978AA65FADBCB9026B69C8B4F43749FA2DC719AB4AD7489745BAC8D66
SHA-512:	675902DD643946882E22E6F6D6B07A39177FAA63AA7F4F474B1413DD75B7ECA887B40F1ABDDFE93EFF0F20728AFBAEB1022244E7561FADB44242E994D7073E4F
Malicious:	false
Preview:	..........E.M.B.E.D. .A.c.r.o.E.x.c.h...D.o.c.u.m.e.n.t...D.C..... . .....E.M.B.E.D. .A.c.r.o.E.x.c.h...D.o.c.u.m.e.n.t...D.C..... . .....E.M.B.E.D. .A.c.r.o.E.x.c.h...D.o.c.u.m.e.n.t...D.C..... . .....E.M.B.E.D. .A.c.r.o.E.x.c.h...D.o.c.u.m.e.n.t...D.C..... . .......E.M.B.E.D. .A.c.r.o.E.x.c.h...D.o.c.u.m.e.n.t...D.C..... . .....E.M.B.E.D. .A.c.r.o.E.x.c.h...D.o.c.u.m.e.n.t...D.C..... . .....E.M.B.E.D. .A.c.r.o.E.x.c.h...D.o.c.u.m.e.n.t...D.C..... . .....E.M.B.E.D. .A.c.r.o.E.x.c.h...D.o.c.u.m.e.n.t...D.C.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E279F50C-91EA-4841-A527-8D9534FAEB24}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{566E8198-3E70-454E-BD79-983511A39AB5}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025580739348717164
Encrypted:	false
SSDEEP:	6:I3DPcd2VvxggLRKmpxIljFRXv//4tfnRujlw//+GtluJ/eRuj:I3DPI2ZfpwbvYg3J/
MD5:	B36B61C3586732F8D6A58F047CCD967A
SHA1:	8276A7FA286557CF8A031947B0C6B5ECA3E8FCC9
SHA-256:	5FFD4423432F21A01C433B5F5EDA20ED1065F3929CBC69D96815428B5D2650DF
SHA-512:	A029FF1927170E36F862E5FC27048ECDB138E16080E5E8DD39F168A3F8230C6AC9DC8CF63A6BB4261ABEA2A8A61A31787ED914BC84116E60F5A0F94BC6540984
Malicious:	false
Preview:	......M.eFy...z.ot....B..h.D..FS,...X.F...Fa.q............................W@..p..J.eY\|..p.........(7.e.2]@.v..#.P......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{D5E9348E-AFB5-4D2F-BD80-A0F3C3BC40FC}

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025641896670120692
Encrypted:	false
SSDEEP:	6:I3DPc0YhFvxggLR7fWlgt/1u5FRXv//4tfnRujlw//+GtluJ/eRuj:I3DPgX+lg1uvYg3J/
MD5:	680F359FA02E81BA50C3E8448E96910D
SHA1:	3ADC8B8D9E8AC216FBD9E9EEB1254DD3CD35EEDF
SHA-256:	ED49C5509A30F55AB6122B209D618D82A8EB339CB4B70A6D07387B7A428EDAA9
SHA-512:	8D2DA529F879EC8F049F6A928C433A2AD5538101207E1C0F0FBEF0EAF7696E6FEE6A2AB1A810A32F12F27C8F2B17DCCB64F336B6821BC92268145A43079845DD
Malicious:	false
Preview:	......M.eFy...z(.....5F.Q......S,...X.F...Fa.q............................,pJ6...I..`Z..........\r"...}A..b].........................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Offer 15492024 15602024.docx.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:05 2023, mtime=Fri Aug 11 15:42:05 2023, atime=Thu May 23 17:41:04 2024, length=419998, window=hide
Category:	dropped
Size (bytes):	1104
Entropy (8bit):	4.5347997993411235
Encrypted:	false
SSDEEP:	24:8W/XTRMfxO4Qi1E3o2eHNE3oPDv3qlk7N:8W/XTI6iW42P4eliN
MD5:	B666B0094DC8DAA10E3352F462959E1D
SHA1:	377B94B69CEDDF6CC0041C6F8C5127D4157FDD3D
SHA-256:	BC3DC0677B15AC876BFFCB231FD0B8BDF351B1E832FA171838D8806880BF0E72
SHA-512:	69A050ECD605A59B46A8DBEA8BEB9DA41E16CD5A695BA7F8CC0D1F0F5E2D95ADD460C6DFDD9A53869441264DE97EA8419144C8DBBADEF76B00995BDE7F5F03A8
Malicious:	false
Preview:	L..................F.... ....c#.r....c#.r.....9.@....h...........................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......X ...user.8......QK.X.X ....&=....U...............A.l.b.u.s.....z.1......WD...Desktop.d......QK.X.WD...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2..h...X#. .OFFER1~1.DOC..n.......WC..WC..........................O.f.f.e.r. .1.5.4.9.2.0.2.4. .1.5.6.0.2.0.2.4...d.o.c.x...d.o.c.......................-...8...[............?J......C:\Users\..#...................\\287400\Users.user\Desktop\Offer 15492024 15602024.docx.doc.7.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.O.f.f.e.r. .1.5.4.9.2.0.2.4. .1.5.6.0.2.0.2.4...d.o.c.x...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.........

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.565363340937963
Encrypted:	false
SSDEEP:	3:M14DAVJu1LBK6Sm4QcVJu1LBK6Sv:MGDAVt6VcVt6c
MD5:	27720B0EBD8D1A7306EA64D22154D48D
SHA1:	FC9F9D144D8A9F87246C4B20EAB85920FF9D6A23
SHA-256:	BF29844CFD0EE81CD982E18219B05C4893A00B3E2223A27DACE34179165C4AE5
SHA-512:	7D376C43886E0A0CAE4805AA17E00777F078A3255480F1854DD063EFDB8274D4813D59D79DA96C030C982CA4DB0438BD397FE4A36B06CA5067406D9D6BB4D0E2
Malicious:	false
Preview:	[doc]..Offer 15492024 15602024.docx.LNK=0..[folders]..Offer 15492024 15602024.docx.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyxblgl0nGltlMWtVGXlcNOllln:vdsCkWtMe2G/LkXh/l
MD5:	89AFCB26CA4D4A770472A95DF4A52BA8
SHA1:	C3B3FEAEF38C3071AC81BC6A32242E6C39BEE9B5
SHA-256:	EF0F4A287E5375B5BFFAE39536E50FDAE97CD185C0F7892C7D25BD733E7D2F17
SHA-512:	EA44D55E57AEFA8D6F586F144CB982145384F681D0391C5AD8E616A67D77913152DB7B0F927E57CDA3D1ECEC3D343A1D6E060EAFF8E8FEDBE38394DFED8224CC
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\Desktop\~$fer 15492024 15602024.docx.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyxblgl0nGltlMWtVGXlcNOllln:vdsCkWtMe2G/LkXh/l
MD5:	89AFCB26CA4D4A770472A95DF4A52BA8
SHA1:	C3B3FEAEF38C3071AC81BC6A32242E6C39BEE9B5
SHA-256:	EF0F4A287E5375B5BFFAE39536E50FDAE97CD185C0F7892C7D25BD733E7D2F17
SHA-512:	EA44D55E57AEFA8D6F586F144CB982145384F681D0391C5AD8E616A67D77913152DB7B0F927E57CDA3D1ECEC3D343A1D6E060EAFF8E8FEDBE38394DFED8224CC
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.989392785502853
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41%
File name:	Offer 15492024 15602024.docx.doc
File size:	419'998 bytes
MD5:	0d0f500d82551e733eab0fb1060a49da
SHA1:	1e9af5dd484358b007673b0d7f9b85f8ac1a7b6c
SHA256:	d5e214f3096564dfc3e348b6a3ac6aeefed75d785ac7cfab5d3019f67fdbc9be
SHA512:	79a0847d2d3d8399796365bd778785531643506634d64302a075fb5ee5206564a0d7d03b90e38f55c55e441e6bfddcbb1035a452123a8048044588cbfca16f82
SSDEEP:	6144:D/46IX/fLf6fwf2Q5OmfRfufffXFO6S951ndPJHf9frX:DgvfLf6fwfdOmfRfufffX4h1dPRf9fr
TLSH:	CA9401FF33A0F619DC2F3947C4A64D41D27798851C994D38393EA35B06AB1A5A3708BB
File Content Preview:	PK.........r.X.4..m...........[Content_Types].xmlUT...rQOfrQOfrQOf.T.n.0..W.?D....CUU..]......{.n..6..wL(.* m.K...[f<q...[..........p+....m....,Df.S.@I...pp}.......&.d....4..h.... R[.Y.W?....6.z...RnM....4....5...=..s....d.M]..sNI.".ta....... ,.k..V..z.

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	11

OLE File "Offer 15492024 15602024.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	23
Total Edit Time:	5
Create Time:	2023-11-10T01:33:00Z
Last Saved Time:	2024-05-15T06:47:00Z
Number of Pages:	1
Number of Words:	53
Number of Characters:	304
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	2
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.8475846798245739
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 01 00

Stream Path: CONTENTS, File Type: PDF document, version 1.5, 1 pages (zip deflate encoded), Stream Size: 30959

General
Stream Path:	CONTENTS
CLSID:
File Type:	PDF document, version 1.5, 1 pages (zip deflate encoded)
Stream Size:	30959
Entropy:	7.915983867366053
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 5 . % . 3 0 o b j . < < / C o l o r S p a c e / D e v i c e G r a y / S u b t y p e / I m a g e / H e i g h t 7 2 / F i l t e r / F l a t e D e c o d e / T y p e / X O b j e c t / W i d t h 2 5 5 / L e n g t h 2 0 8 1 / B i t s P e r C o m p o n e n t 8 > > s t r e a m . x { P . U . & B & o 1 b F P s . R 2 . . . . * Y 6 3 . . # N L 8 T X R \| ( ( " * " < 6 ] . . { n n \| . . s ` . . , b . E . . . q . ( ` o ^ E Y . 7 N Y ] . H X ^ 3 n . . " K . . . . . . * o " . E ( > . . . . . . .
Data Raw:	25 50 44 46 2d 31 2e 35 0a 25 e2 e3 cf d3 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 43 6f 6c 6f 72 53 70 61 63 65 2f 44 65 76 69 63 65 47 72 61 79 2f 53 75 62 74 79 70 65 2f 49 6d 61 67 65 2f 48 65 69 67 68 74 20 37 32 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 2f 57 69 64 74 68 20 32 35 35 2f 4c 65 6e 67 74 68 20 32 30 38 31 2f 42 69

OLE File "Offer 15492024 15602024.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	23
Total Edit Time:	5
Create Time:	2023-11-10T01:33:00Z
Last Saved Time:	2024-05-15T06:47:00Z
Number of Pages:	1
Number of Words:	53
Number of Characters:	304
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	2
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.8475846798245739
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 01 00

Stream Path: CONTENTS, File Type: PDF document, version 1.5, 1 pages (zip deflate encoded), Stream Size: 30959

General
Stream Path:	CONTENTS
CLSID:
File Type:	PDF document, version 1.5, 1 pages (zip deflate encoded)
Stream Size:	30959
Entropy:	7.915983867366053
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 5 . % . 3 0 o b j . < < / C o l o r S p a c e / D e v i c e G r a y / S u b t y p e / I m a g e / H e i g h t 7 2 / F i l t e r / F l a t e D e c o d e / T y p e / X O b j e c t / W i d t h 2 5 5 / L e n g t h 2 0 8 1 / B i t s P e r C o m p o n e n t 8 > > s t r e a m . x { P . U . & B & o 1 b F P s . R 2 . . . . * Y 6 3 . . # N L 8 T X R \| ( ( " * " < 6 ] . . { n n \| . . s ` . . , b . E . . . q . ( ` o ^ E Y . 7 N Y ] . H X ^ 3 n . . " K . . . . . . * o " . E ( > . . . . . . .
Data Raw:	25 50 44 46 2d 31 2e 35 0a 25 e2 e3 cf d3 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 43 6f 6c 6f 72 53 70 61 63 65 2f 44 65 76 69 63 65 47 72 61 79 2f 53 75 62 74 79 70 65 2f 49 6d 61 67 65 2f 48 65 69 67 68 74 20 37 32 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 2f 57 69 64 74 68 20 32 35 35 2f 4c 65 6e 67 74 68 20 32 30 38 31 2f 42 69

OLE File "Offer 15492024 15602024.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	23
Total Edit Time:	5
Create Time:	2023-11-10T01:33:00Z
Last Saved Time:	2024-05-15T06:47:00Z
Number of Pages:	1
Number of Words:	53
Number of Characters:	304
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	2
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.8475846798245739
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 01 00

Stream Path: CONTENTS, File Type: PDF document, version 1.5, 1 pages (zip deflate encoded), Stream Size: 30959

General
Stream Path:	CONTENTS
CLSID:
File Type:	PDF document, version 1.5, 1 pages (zip deflate encoded)
Stream Size:	30959
Entropy:	7.915983867366053
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 5 . % . 3 0 o b j . < < / C o l o r S p a c e / D e v i c e G r a y / S u b t y p e / I m a g e / H e i g h t 7 2 / F i l t e r / F l a t e D e c o d e / T y p e / X O b j e c t / W i d t h 2 5 5 / L e n g t h 2 0 8 1 / B i t s P e r C o m p o n e n t 8 > > s t r e a m . x { P . U . & B & o 1 b F P s . R 2 . . . . * Y 6 3 . . # N L 8 T X R \| ( ( " * " < 6 ] . . { n n \| . . s ` . . , b . E . . . q . ( ` o ^ E Y . 7 N Y ] . H X ^ 3 n . . " K . . . . . . * o " . E ( > . . . . . . .
Data Raw:	25 50 44 46 2d 31 2e 35 0a 25 e2 e3 cf d3 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 43 6f 6c 6f 72 53 70 61 63 65 2f 44 65 76 69 63 65 47 72 61 79 2f 53 75 62 74 79 70 65 2f 49 6d 61 67 65 2f 48 65 69 67 68 74 20 37 32 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 2f 57 69 64 74 68 20 32 35 35 2f 4c 65 6e 67 74 68 20 32 30 38 31 2f 42 69

OLE File "Offer 15492024 15602024.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	23
Total Edit Time:	5
Create Time:	2023-11-10T01:33:00Z
Last Saved Time:	2024-05-15T06:47:00Z
Number of Pages:	1
Number of Words:	53
Number of Characters:	304
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	2
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.8475846798245739
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 01 00

Stream Path: CONTENTS, File Type: PDF document, version 1.5, 1 pages (zip deflate encoded), Stream Size: 30959

General
Stream Path:	CONTENTS
CLSID:
File Type:	PDF document, version 1.5, 1 pages (zip deflate encoded)
Stream Size:	30959
Entropy:	7.915983867366053
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 5 . % . 3 0 o b j . < < / C o l o r S p a c e / D e v i c e G r a y / S u b t y p e / I m a g e / H e i g h t 7 2 / F i l t e r / F l a t e D e c o d e / T y p e / X O b j e c t / W i d t h 2 5 5 / L e n g t h 2 0 8 1 / B i t s P e r C o m p o n e n t 8 > > s t r e a m . x { P . U . & B & o 1 b F P s . R 2 . . . . * Y 6 3 . . # N L 8 T X R \| ( ( " * " < 6 ] . . { n n \| . . s ` . . , b . E . . . q . ( ` o ^ E Y . 7 N Y ] . H X ^ 3 n . . " K . . . . . . * o " . E ( > . . . . . . .
Data Raw:	25 50 44 46 2d 31 2e 35 0a 25 e2 e3 cf d3 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 43 6f 6c 6f 72 53 70 61 63 65 2f 44 65 76 69 63 65 47 72 61 79 2f 53 75 62 74 79 70 65 2f 49 6d 61 67 65 2f 48 65 69 67 68 74 20 37 32 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 2f 57 69 64 74 68 20 32 35 35 2f 4c 65 6e 67 74 68 20 32 30 38 31 2f 42 69

OLE File "Offer 15492024 15602024.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	23
Total Edit Time:	5
Create Time:	2023-11-10T01:33:00Z
Last Saved Time:	2024-05-15T06:47:00Z
Number of Pages:	1
Number of Words:	53
Number of Characters:	304
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	2
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.8475846798245739
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 01 00

Stream Path: CONTENTS, File Type: PDF document, version 1.5, 1 pages (zip deflate encoded), Stream Size: 31606

General
Stream Path:	CONTENTS
CLSID:
File Type:	PDF document, version 1.5, 1 pages (zip deflate encoded)
Stream Size:	31606
Entropy:	7.916695020479147
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 5 . % . 3 0 o b j . < < / C o l o r S p a c e / D e v i c e G r a y / S u b t y p e / I m a g e / H e i g h t 7 2 / F i l t e r / F l a t e D e c o d e / T y p e / X O b j e c t / W i d t h 2 5 5 / L e n g t h 2 0 8 1 / B i t s P e r C o m p o n e n t 8 > > s t r e a m . x { P . U . & B & o 1 b F P s . R 2 . . . . * Y 6 3 . . # N L 8 T X R \| ( ( " * " < 6 ] . . { n n \| . . s ` . . , b . E . . . q . ( ` o ^ E Y . 7 N Y ] . H X ^ 3 n . . " K . . . . . . * o " . E ( > . . . . . . .
Data Raw:	25 50 44 46 2d 31 2e 35 0a 25 e2 e3 cf d3 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 43 6f 6c 6f 72 53 70 61 63 65 2f 44 65 76 69 63 65 47 72 61 79 2f 53 75 62 74 79 70 65 2f 49 6d 61 67 65 2f 48 65 69 67 68 74 20 37 32 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 2f 57 69 64 74 68 20 32 35 35 2f 4c 65 6e 67 74 68 20 32 30 38 31 2f 42 69

OLE File "Offer 15492024 15602024.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	23
Total Edit Time:	5
Create Time:	2023-11-10T01:33:00Z
Last Saved Time:	2024-05-15T06:47:00Z
Number of Pages:	1
Number of Words:	53
Number of Characters:	304
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	2
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.8475846798245739
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 01 00

Stream Path: CONTENTS, File Type: PDF document, version 1.5, 1 pages (zip deflate encoded), Stream Size: 30959

General
Stream Path:	CONTENTS
CLSID:
File Type:	PDF document, version 1.5, 1 pages (zip deflate encoded)
Stream Size:	30959
Entropy:	7.915983867366053
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 5 . % . 3 0 o b j . < < / C o l o r S p a c e / D e v i c e G r a y / S u b t y p e / I m a g e / H e i g h t 7 2 / F i l t e r / F l a t e D e c o d e / T y p e / X O b j e c t / W i d t h 2 5 5 / L e n g t h 2 0 8 1 / B i t s P e r C o m p o n e n t 8 > > s t r e a m . x { P . U . & B & o 1 b F P s . R 2 . . . . * Y 6 3 . . # N L 8 T X R \| ( ( " * " < 6 ] . . { n n \| . . s ` . . , b . E . . . q . ( ` o ^ E Y . 7 N Y ] . H X ^ 3 n . . " K . . . . . . * o " . E ( > . . . . . . .
Data Raw:	25 50 44 46 2d 31 2e 35 0a 25 e2 e3 cf d3 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 43 6f 6c 6f 72 53 70 61 63 65 2f 44 65 76 69 63 65 47 72 61 79 2f 53 75 62 74 79 70 65 2f 49 6d 61 67 65 2f 48 65 69 67 68 74 20 37 32 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 2f 57 69 64 74 68 20 32 35 35 2f 4c 65 6e 67 74 68 20 32 30 38 31 2f 42 69

OLE File "Offer 15492024 15602024.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	23
Total Edit Time:	5
Create Time:	2023-11-10T01:33:00Z
Last Saved Time:	2024-05-15T06:47:00Z
Number of Pages:	1
Number of Words:	53
Number of Characters:	304
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	2
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.8475846798245739
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 01 00

Stream Path: CONTENTS, File Type: PDF document, version 1.5, 1 pages (zip deflate encoded), Stream Size: 30959

General
Stream Path:	CONTENTS
CLSID:
File Type:	PDF document, version 1.5, 1 pages (zip deflate encoded)
Stream Size:	30959
Entropy:	7.915983867366053
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 5 . % . 3 0 o b j . < < / C o l o r S p a c e / D e v i c e G r a y / S u b t y p e / I m a g e / H e i g h t 7 2 / F i l t e r / F l a t e D e c o d e / T y p e / X O b j e c t / W i d t h 2 5 5 / L e n g t h 2 0 8 1 / B i t s P e r C o m p o n e n t 8 > > s t r e a m . x { P . U . & B & o 1 b F P s . R 2 . . . . * Y 6 3 . . # N L 8 T X R \| ( ( " * " < 6 ] . . { n n \| . . s ` . . , b . E . . . q . ( ` o ^ E Y . 7 N Y ] . H X ^ 3 n . . " K . . . . . . * o " . E ( > . . . . . . .
Data Raw:	25 50 44 46 2d 31 2e 35 0a 25 e2 e3 cf d3 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 43 6f 6c 6f 72 53 70 61 63 65 2f 44 65 76 69 63 65 47 72 61 79 2f 53 75 62 74 79 70 65 2f 49 6d 61 67 65 2f 48 65 69 67 68 74 20 37 32 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 2f 57 69 64 74 68 20 32 35 35 2f 4c 65 6e 67 74 68 20 32 30 38 31 2f 42 69

OLE File "Offer 15492024 15602024.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	23
Total Edit Time:	5
Create Time:	2023-11-10T01:33:00Z
Last Saved Time:	2024-05-15T06:47:00Z
Number of Pages:	1
Number of Words:	53
Number of Characters:	304
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	2
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.8475846798245739
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 01 00

Stream Path: CONTENTS, File Type: PDF document, version 1.5, 1 pages (zip deflate encoded), Stream Size: 30959

General
Stream Path:	CONTENTS
CLSID:
File Type:	PDF document, version 1.5, 1 pages (zip deflate encoded)
Stream Size:	30959
Entropy:	7.915983867366053
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 5 . % . 3 0 o b j . < < / C o l o r S p a c e / D e v i c e G r a y / S u b t y p e / I m a g e / H e i g h t 7 2 / F i l t e r / F l a t e D e c o d e / T y p e / X O b j e c t / W i d t h 2 5 5 / L e n g t h 2 0 8 1 / B i t s P e r C o m p o n e n t 8 > > s t r e a m . x { P . U . & B & o 1 b F P s . R 2 . . . . * Y 6 3 . . # N L 8 T X R \| ( ( " * " < 6 ] . . { n n \| . . s ` . . , b . E . . . q . ( ` o ^ E Y . 7 N Y ] . H X ^ 3 n . . " K . . . . . . * o " . E ( > . . . . . . .
Data Raw:	25 50 44 46 2d 31 2e 35 0a 25 e2 e3 cf d3 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 43 6f 6c 6f 72 53 70 61 63 65 2f 44 65 76 69 63 65 47 72 61 79 2f 53 75 62 74 79 70 65 2f 49 6d 61 67 65 2f 48 65 69 67 68 74 20 37 32 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 2f 57 69 64 74 68 20 32 35 35 2f 4c 65 6e 67 74 68 20 32 30 38 31 2f 42 69

OLE File "Offer 15492024 15602024.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	23
Total Edit Time:	5
Create Time:	2023-11-10T01:33:00Z
Last Saved Time:	2024-05-15T06:47:00Z
Number of Pages:	1
Number of Words:	53
Number of Characters:	304
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	2
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.8475846798245739
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 01 00

Stream Path: CONTENTS, File Type: PDF document, version 1.5, 1 pages (zip deflate encoded), Stream Size: 30959

General
Stream Path:	CONTENTS
CLSID:
File Type:	PDF document, version 1.5, 1 pages (zip deflate encoded)
Stream Size:	30959
Entropy:	7.915983867366053
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 5 . % . 3 0 o b j . < < / C o l o r S p a c e / D e v i c e G r a y / S u b t y p e / I m a g e / H e i g h t 7 2 / F i l t e r / F l a t e D e c o d e / T y p e / X O b j e c t / W i d t h 2 5 5 / L e n g t h 2 0 8 1 / B i t s P e r C o m p o n e n t 8 > > s t r e a m . x { P . U . & B & o 1 b F P s . R 2 . . . . * Y 6 3 . . # N L 8 T X R \| ( ( " * " < 6 ] . . { n n \| . . s ` . . , b . E . . . q . ( ` o ^ E Y . 7 N Y ] . H X ^ 3 n . . " K . . . . . . * o " . E ( > . . . . . . .
Data Raw:	25 50 44 46 2d 31 2e 35 0a 25 e2 e3 cf d3 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 43 6f 6c 6f 72 53 70 61 63 65 2f 44 65 76 69 63 65 47 72 61 79 2f 53 75 62 74 79 70 65 2f 49 6d 61 67 65 2f 48 65 69 67 68 74 20 37 32 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 2f 57 69 64 74 68 20 32 35 35 2f 4c 65 6e 67 74 68 20 32 30 38 31 2f 42 69

OLE File "Offer 15492024 15602024.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	23
Total Edit Time:	5
Create Time:	2023-11-10T01:33:00Z
Last Saved Time:	2024-05-15T06:47:00Z
Number of Pages:	1
Number of Words:	53
Number of Characters:	304
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	2
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.8475846798245739
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 01 00

Stream Path: CONTENTS, File Type: PDF document, version 1.5, 1 pages (zip deflate encoded), Stream Size: 30959

General
Stream Path:	CONTENTS
CLSID:
File Type:	PDF document, version 1.5, 1 pages (zip deflate encoded)
Stream Size:	30959
Entropy:	7.915983867366053
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 5 . % . 3 0 o b j . < < / C o l o r S p a c e / D e v i c e G r a y / S u b t y p e / I m a g e / H e i g h t 7 2 / F i l t e r / F l a t e D e c o d e / T y p e / X O b j e c t / W i d t h 2 5 5 / L e n g t h 2 0 8 1 / B i t s P e r C o m p o n e n t 8 > > s t r e a m . x { P . U . & B & o 1 b F P s . R 2 . . . . * Y 6 3 . . # N L 8 T X R \| ( ( " * " < 6 ] . . { n n \| . . s ` . . , b . E . . . q . ( ` o ^ E Y . 7 N Y ] . H X ^ 3 n . . " K . . . . . . * o " . E ( > . . . . . . .
Data Raw:	25 50 44 46 2d 31 2e 35 0a 25 e2 e3 cf d3 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 43 6f 6c 6f 72 53 70 61 63 65 2f 44 65 76 69 63 65 47 72 61 79 2f 53 75 62 74 79 70 65 2f 49 6d 61 67 65 2f 48 65 69 67 68 74 20 37 32 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 2f 57 69 64 74 68 20 32 35 35 2f 4c 65 6e 67 74 68 20 32 30 38 31 2f 42 69

OLE File "Offer 15492024 15602024.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	23
Total Edit Time:	5
Create Time:	2023-11-10T01:33:00Z
Last Saved Time:	2024-05-15T06:47:00Z
Number of Pages:	1
Number of Words:	53
Number of Characters:	304
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	2
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.8475846798245739
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 01 00

Stream Path: CONTENTS, File Type: PDF document, version 1.5, 1 pages (zip deflate encoded), Stream Size: 30959

General
Stream Path:	CONTENTS
CLSID:
File Type:	PDF document, version 1.5, 1 pages (zip deflate encoded)
Stream Size:	30959
Entropy:	7.915983867366053
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 5 . % . 3 0 o b j . < < / C o l o r S p a c e / D e v i c e G r a y / S u b t y p e / I m a g e / H e i g h t 7 2 / F i l t e r / F l a t e D e c o d e / T y p e / X O b j e c t / W i d t h 2 5 5 / L e n g t h 2 0 8 1 / B i t s P e r C o m p o n e n t 8 > > s t r e a m . x { P . U . & B & o 1 b F P s . R 2 . . . . * Y 6 3 . . # N L 8 T X R \| ( ( " * " < 6 ] . . { n n \| . . s ` . . , b . E . . . q . ( ` o ^ E Y . 7 N Y ] . H X ^ 3 n . . " K . . . . . . * o " . E ( > . . . . . . .
Data Raw:	25 50 44 46 2d 31 2e 35 0a 25 e2 e3 cf d3 0a 33 20 30 20 6f 62 6a 0a 3c 3c 2f 43 6f 6c 6f 72 53 70 61 63 65 2f 44 65 76 69 63 65 47 72 61 79 2f 53 75 62 74 79 70 65 2f 49 6d 61 67 65 2f 48 65 69 67 68 74 20 37 32 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 44 65 63 6f 64 65 2f 54 79 70 65 2f 58 4f 62 6a 65 63 74 2f 57 69 64 74 68 20 32 35 35 2f 4c 65 6e 67 74 68 20 32 30 38 31 2f 42 69

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 20:41:07.471960068 CEST	49165	80	192.168.2.22	104.21.47.128
May 23, 2024 20:41:07.477112055 CEST	80	49165	104.21.47.128	192.168.2.22
May 23, 2024 20:41:07.477988005 CEST	49165	80	192.168.2.22	104.21.47.128
May 23, 2024 20:41:07.477988005 CEST	49165	80	192.168.2.22	104.21.47.128
May 23, 2024 20:41:07.538378954 CEST	80	49165	104.21.47.128	192.168.2.22
May 23, 2024 20:41:07.981889009 CEST	80	49165	104.21.47.128	192.168.2.22
May 23, 2024 20:41:07.982006073 CEST	49165	80	192.168.2.22	104.21.47.128
May 23, 2024 20:41:08.824843884 CEST	49166	80	192.168.2.22	172.67.171.37
May 23, 2024 20:41:08.831984997 CEST	80	49166	172.67.171.37	192.168.2.22
May 23, 2024 20:41:08.832052946 CEST	49166	80	192.168.2.22	172.67.171.37
May 23, 2024 20:41:08.836752892 CEST	49166	80	192.168.2.22	172.67.171.37
May 23, 2024 20:41:08.890639067 CEST	80	49166	172.67.171.37	192.168.2.22
May 23, 2024 20:41:09.331096888 CEST	80	49166	172.67.171.37	192.168.2.22
May 23, 2024 20:41:09.384215117 CEST	49167	443	192.168.2.22	172.67.171.37
May 23, 2024 20:41:09.384269953 CEST	443	49167	172.67.171.37	192.168.2.22
May 23, 2024 20:41:09.384341955 CEST	49167	443	192.168.2.22	172.67.171.37
May 23, 2024 20:41:09.398358107 CEST	49167	443	192.168.2.22	172.67.171.37
May 23, 2024 20:41:09.398370981 CEST	443	49167	172.67.171.37	192.168.2.22
May 23, 2024 20:41:09.543016911 CEST	80	49166	172.67.171.37	192.168.2.22
May 23, 2024 20:41:09.543080091 CEST	49166	80	192.168.2.22	172.67.171.37
May 23, 2024 20:41:09.998325109 CEST	443	49167	172.67.171.37	192.168.2.22
May 23, 2024 20:41:09.998420000 CEST	49167	443	192.168.2.22	172.67.171.37
May 23, 2024 20:41:10.002741098 CEST	49167	443	192.168.2.22	172.67.171.37
May 23, 2024 20:41:10.002753019 CEST	443	49167	172.67.171.37	192.168.2.22
May 23, 2024 20:41:10.003046989 CEST	443	49167	172.67.171.37	192.168.2.22
May 23, 2024 20:41:10.126640081 CEST	49167	443	192.168.2.22	172.67.171.37
May 23, 2024 20:41:10.170502901 CEST	443	49167	172.67.171.37	192.168.2.22
May 23, 2024 20:41:10.791884899 CEST	443	49167	172.67.171.37	192.168.2.22
May 23, 2024 20:41:10.791945934 CEST	443	49167	172.67.171.37	192.168.2.22
May 23, 2024 20:41:10.792159081 CEST	49167	443	192.168.2.22	172.67.171.37
May 23, 2024 20:41:10.795835972 CEST	49167	443	192.168.2.22	172.67.171.37
May 23, 2024 20:41:10.795866013 CEST	443	49167	172.67.171.37	192.168.2.22
May 23, 2024 20:41:14.126616955 CEST	49168	80	192.168.2.22	104.21.47.128
May 23, 2024 20:41:14.131695986 CEST	80	49168	104.21.47.128	192.168.2.22
May 23, 2024 20:41:14.131759882 CEST	49168	80	192.168.2.22	104.21.47.128
May 23, 2024 20:41:14.131853104 CEST	49168	80	192.168.2.22	104.21.47.128
May 23, 2024 20:41:14.183847904 CEST	80	49168	104.21.47.128	192.168.2.22
May 23, 2024 20:41:14.680459976 CEST	80	49168	104.21.47.128	192.168.2.22
May 23, 2024 20:41:14.687987089 CEST	49169	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:14.688033104 CEST	443	49169	104.21.47.128	192.168.2.22
May 23, 2024 20:41:14.688092947 CEST	49169	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:14.722373009 CEST	49169	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:14.722409964 CEST	443	49169	104.21.47.128	192.168.2.22
May 23, 2024 20:41:14.881248951 CEST	49168	80	192.168.2.22	104.21.47.128
May 23, 2024 20:41:15.206965923 CEST	443	49169	104.21.47.128	192.168.2.22
May 23, 2024 20:41:15.207088947 CEST	49169	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:15.211122036 CEST	49169	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:15.211154938 CEST	443	49169	104.21.47.128	192.168.2.22
May 23, 2024 20:41:15.211457968 CEST	443	49169	104.21.47.128	192.168.2.22
May 23, 2024 20:41:15.224982977 CEST	49169	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:15.270504951 CEST	443	49169	104.21.47.128	192.168.2.22
May 23, 2024 20:41:15.553762913 CEST	443	49169	104.21.47.128	192.168.2.22
May 23, 2024 20:41:15.554404020 CEST	49169	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:15.588927984 CEST	49165	80	192.168.2.22	104.21.47.128
May 23, 2024 20:41:15.884597063 CEST	80	49165	104.21.47.128	192.168.2.22
May 23, 2024 20:41:15.984719038 CEST	80	49165	104.21.47.128	192.168.2.22
May 23, 2024 20:41:15.984869957 CEST	49165	80	192.168.2.22	104.21.47.128
May 23, 2024 20:41:15.991486073 CEST	49170	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:15.991571903 CEST	443	49170	104.21.47.128	192.168.2.22
May 23, 2024 20:41:15.991645098 CEST	49170	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:15.993690014 CEST	49170	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:15.993721008 CEST	443	49170	104.21.47.128	192.168.2.22
May 23, 2024 20:41:16.478889942 CEST	443	49170	104.21.47.128	192.168.2.22
May 23, 2024 20:41:16.478949070 CEST	49170	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:16.484364986 CEST	49170	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:16.484385014 CEST	443	49170	104.21.47.128	192.168.2.22
May 23, 2024 20:41:16.484698057 CEST	443	49170	104.21.47.128	192.168.2.22
May 23, 2024 20:41:16.484752893 CEST	49170	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:16.493171930 CEST	49170	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:16.534497976 CEST	443	49170	104.21.47.128	192.168.2.22
May 23, 2024 20:41:17.111938953 CEST	443	49170	104.21.47.128	192.168.2.22
May 23, 2024 20:41:17.113202095 CEST	49170	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:17.113225937 CEST	443	49170	104.21.47.128	192.168.2.22
May 23, 2024 20:41:17.113289118 CEST	49170	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:17.114264011 CEST	49170	443	192.168.2.22	104.21.47.128
May 23, 2024 20:41:17.114264011 CEST	49170	443	192.168.2.22	104.21.47.128
May 23, 2024 20:42:17.119662046 CEST	49166	80	192.168.2.22	172.67.171.37
May 23, 2024 20:43:05.476443052 CEST	49165	80	192.168.2.22	104.21.47.128
May 23, 2024 20:43:05.487296104 CEST	80	49165	104.21.47.128	192.168.2.22
May 23, 2024 20:43:05.487365007 CEST	49165	80	192.168.2.22	104.21.47.128
May 23, 2024 20:43:14.085959911 CEST	49168	80	192.168.2.22	104.21.47.128

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 20:41:03.806521893 CEST	138	138	192.168.2.22	192.168.2.255
May 23, 2024 20:41:07.448421001 CEST	54562	53	192.168.2.22	8.8.8.8
May 23, 2024 20:41:07.468180895 CEST	53	54562	8.8.8.8	192.168.2.22
May 23, 2024 20:41:08.786509037 CEST	52917	53	192.168.2.22	8.8.8.8
May 23, 2024 20:41:08.806448936 CEST	53	52917	8.8.8.8	192.168.2.22
May 23, 2024 20:41:08.810504913 CEST	62751	53	192.168.2.22	8.8.8.8
May 23, 2024 20:41:08.824281931 CEST	53	62751	8.8.8.8	192.168.2.22
May 23, 2024 20:41:14.105460882 CEST	57893	53	192.168.2.22	8.8.8.8
May 23, 2024 20:41:14.117763996 CEST	53	57893	8.8.8.8	192.168.2.22
May 23, 2024 20:41:14.119044065 CEST	54821	53	192.168.2.22	8.8.8.8
May 23, 2024 20:41:14.126297951 CEST	53	54821	8.8.8.8	192.168.2.22
May 23, 2024 20:41:56.442897081 CEST	137	137	192.168.2.22	192.168.2.255
May 23, 2024 20:41:57.192440033 CEST	137	137	192.168.2.22	192.168.2.255
May 23, 2024 20:41:57.942460060 CEST	137	137	192.168.2.22	192.168.2.255
May 23, 2024 20:42:05.648338079 CEST	137	137	192.168.2.22	192.168.2.255
May 23, 2024 20:42:06.397902966 CEST	137	137	192.168.2.22	192.168.2.255
May 23, 2024 20:42:07.147959948 CEST	137	137	192.168.2.22	192.168.2.255
May 23, 2024 20:42:08.442408085 CEST	137	137	192.168.2.22	192.168.2.255
May 23, 2024 20:42:09.192116976 CEST	137	137	192.168.2.22	192.168.2.255
May 23, 2024 20:42:09.942275047 CEST	137	137	192.168.2.22	192.168.2.255
May 23, 2024 20:43:03.495048046 CEST	138	138	192.168.2.22	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 23, 2024 20:41:07.448421001 CEST	192.168.2.22	8.8.8.8	0xf500	Standard query (0)	bot.ax	A (IP address)	IN (0x0001)	false
May 23, 2024 20:41:08.786509037 CEST	192.168.2.22	8.8.8.8	0x9648	Standard query (0)	bot.ax	A (IP address)	IN (0x0001)	false
May 23, 2024 20:41:08.810504913 CEST	192.168.2.22	8.8.8.8	0xa98e	Standard query (0)	bot.ax	A (IP address)	IN (0x0001)	false
May 23, 2024 20:41:14.105460882 CEST	192.168.2.22	8.8.8.8	0xc083	Standard query (0)	bot.ax	A (IP address)	IN (0x0001)	false
May 23, 2024 20:41:14.119044065 CEST	192.168.2.22	8.8.8.8	0x1100	Standard query (0)	bot.ax	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 23, 2024 20:41:07.468180895 CEST	8.8.8.8	192.168.2.22	0xf500	No error (0)	bot.ax	104.21.47.128	A (IP address)	IN (0x0001)	false
May 23, 2024 20:41:07.468180895 CEST	8.8.8.8	192.168.2.22	0xf500	No error (0)	bot.ax	172.67.171.37	A (IP address)	IN (0x0001)	false
May 23, 2024 20:41:08.806448936 CEST	8.8.8.8	192.168.2.22	0x9648	No error (0)	bot.ax	172.67.171.37	A (IP address)	IN (0x0001)	false
May 23, 2024 20:41:08.806448936 CEST	8.8.8.8	192.168.2.22	0x9648	No error (0)	bot.ax	104.21.47.128	A (IP address)	IN (0x0001)	false
May 23, 2024 20:41:08.824281931 CEST	8.8.8.8	192.168.2.22	0xa98e	No error (0)	bot.ax	104.21.47.128	A (IP address)	IN (0x0001)	false
May 23, 2024 20:41:08.824281931 CEST	8.8.8.8	192.168.2.22	0xa98e	No error (0)	bot.ax	172.67.171.37	A (IP address)	IN (0x0001)	false
May 23, 2024 20:41:14.117763996 CEST	8.8.8.8	192.168.2.22	0xc083	No error (0)	bot.ax	104.21.47.128	A (IP address)	IN (0x0001)	false
May 23, 2024 20:41:14.117763996 CEST	8.8.8.8	192.168.2.22	0xc083	No error (0)	bot.ax	172.67.171.37	A (IP address)	IN (0x0001)	false
May 23, 2024 20:41:14.126297951 CEST	8.8.8.8	192.168.2.22	0x1100	No error (0)	bot.ax	172.67.171.37	A (IP address)	IN (0x0001)	false
May 23, 2024 20:41:14.126297951 CEST	8.8.8.8	192.168.2.22	0x1100	No error (0)	bot.ax	104.21.47.128	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bot.ax

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49165	104.21.47.128	80	2088	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
May 23, 2024 20:41:07.477988005 CEST	128	OUT	OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: bot.ax Content-Length: 0 Connection: Keep-Alive
May 23, 2024 20:41:07.981889009 CEST	799	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 23 May 2024 18:41:07 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 23 May 2024 19:41:07 GMT Location: https://bot.ax/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o7Y2SURlNXiKeuKIDenZfKq7FmgXtGyotTP5%2B2e%2FRYP2Io8WP6LekuyCQDfldQGGWIhsZKi20lQQDTd%2BfGImu8QyCHOHIEMJ1oWoJq%2BjflsNH0MGh1LHmgI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88872da89b9a421f-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
May 23, 2024 20:41:15.588927984 CEST	342	OUT	GET /hNZdz HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14) UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: bot.ax Connection: Keep-Alive
May 23, 2024 20:41:15.984719038 CEST	831	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 23 May 2024 18:41:15 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 23 May 2024 19:41:15 GMT Location: https://bot.ax/hNZdz Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hD9pq4w18LwG5%2FYO729WRPWeigLf9HofAS2lpBUVqlfXPONui4UY4T9q%2F%2BJx7794R4dvYARYc7uzE4McgX%2BSZoYZ%2FuQHoiafWkiGvDDQrVgI%2FVVtkwFEmo4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 88872dda9fae421f-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49166	172.67.171.37	80	2088	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
May 23, 2024 20:41:08.836752892 CEST	112	OUT	HEAD /hNZdz HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: bot.ax
May 23, 2024 20:41:09.331096888 CEST	631	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 23 May 2024 18:41:09 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 23 May 2024 19:41:09 GMT Location: https://bot.ax/hNZdz Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RnWYcNIiauhMqfqSpdA714kFOdmfeImfZUxZDIzp6qQDddw7ut4vmf4k3KFcIvy8YrZVmacRKcQYhjdhaokTvC4KhCM48qDZYSUYCUTv8mU%2BFzW2XZalC7Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88872db0ee368c33-EWR alt-svc: h3=":443"; ma=86400
May 23, 2024 20:41:09.543016911 CEST	631	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 23 May 2024 18:41:09 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 23 May 2024 19:41:09 GMT Location: https://bot.ax/hNZdz Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RnWYcNIiauhMqfqSpdA714kFOdmfeImfZUxZDIzp6qQDddw7ut4vmf4k3KFcIvy8YrZVmacRKcQYhjdhaokTvC4KhCM48qDZYSUYCUTv8mU%2BFzW2XZalC7Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88872db0ee368c33-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.22	49168	104.21.47.128	80

Timestamp	Bytes transferred	Direction	Data
May 23, 2024 20:41:14.131853104 CEST	123	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 translate: f Host: bot.ax
May 23, 2024 20:41:14.680459976 CEST	803	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 23 May 2024 18:41:14 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 23 May 2024 19:41:14 GMT Location: https://bot.ax/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F87q6sIplpTMZgi6QDOl6rPlb6MdjwG7X%2F1lSAkW7NYWWknkrr3CmgVbASouSolw%2BMAOz6%2B%2Bd3RTDKpyGmPz%2F6XEv4RbXi44GnDC3LyuvWn9ZhUNOGtr9dg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88872dd26ebd4411-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49167	172.67.171.37	443	2088	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-05-23 18:41:10 UTC	112	OUT	HEAD /hNZdz HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: bot.ax
2024-05-23 18:41:10 UTC	711	IN	HTTP/1.1 404 Not Found Date: Thu, 23 May 2024 18:41:10 GMT Content-Type: text/html; charset=UTF-8 Connection: close set-cookie: PHPSESSID=ccqb5jblbbpgelnc46rrjjjacs; path=/ expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eWn4AR2JlvSGXIYHhmmkBq4m0b9AN9ruCiuFGW5GrXSo3pf1ytUz5%2F4dXhkqFI2X91%2BaP9fqqSKY%2FAKuo%2FSYodhTojFaZC77pauiNowuecahNqhZ1ofoZWo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88872db6a9cd0f6b-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.22	49169	104.21.47.128	443

Timestamp	Bytes transferred	Direction	Data
2024-05-23 18:41:15 UTC	123	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 translate: f Host: bot.ax
2024-05-23 18:41:15 UTC	767	IN	HTTP/1.1 405 Method Not Allowed Date: Thu, 23 May 2024 18:41:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close set-cookie: PHPSESSID=vi0g644smke6mh7l046t0eaii7; path=/ expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eoINRBPB0nqLRMbDQTFWlk4bn781OlbndN2QjuyFNNNl9cbuOQf6MshY0zfU%2F0up0UJHT79xYbN7zFlpyLjbJdpGAuWuWj10ZbaUJko8KOkClA%2FZGSRGrtw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88872dd69d951889-EWR alt-svc: h3=":443"; ma=86400
2024-05-23 18:41:15 UTC	602	IN	Data Raw: 36 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 09 09 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 09 09 09 3c 68 65 61 64 3e 0a 09 09 09 09 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 09 09 20 20 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 3c 2f 74 69 74 6c 65 3e 0a 09 09 09 09 20 20 20 20 3c 6c 69 Data Ascii: 6ac<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="viewport" content="width=device-width, initial-scale=1" /> <title>Error 405</title> <li

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49170	104.21.47.128	443	2088	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-05-23 18:41:16 UTC	342	OUT	GET /hNZdz HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14) UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: bot.ax Connection: Keep-Alive
2024-05-23 18:41:17 UTC	758	IN	HTTP/1.1 404 Not Found Date: Thu, 23 May 2024 18:41:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close set-cookie: PHPSESSID=8pqa1qkp3733as8k1h92tuc7et; path=/ expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zg3sDoZsaDlJ2YKgBtWaci3lH8cInlpxk2SYPdK6Pw2WOmshxm%2BqnEe4zHlQKB1chA1TOG7T4qp7l5mPW3u59W1eb4lj4OQHiv%2BtcaMYWFSUprWjrvffodk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88872dded9010dc7-EWR alt-svc: h3=":443"; ma=86400
2024-05-23 18:41:17 UTC	611	IN	Data Raw: 66 37 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 45 Data Ascii: f75<!DOCTYPE html><html lang="en"> <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <title>E

Target ID:	0
Start time:	14:41:04
Start date:	23/05/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13fc20000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	14:41:35
Start date:	23/05/2024
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
Imagebase:	0xe0000
File size:	2'525'680 bytes
MD5 hash:	2F8D93826B8CBF9290BC57535C7A6817
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	14:41:41
Start date:	23/05/2024
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
Imagebase:	0x20000
File size:	9'805'808 bytes
MD5 hash:	326A645391A97C760B60C558A35BB068
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Offer 15492024 15602024.docx.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF510964.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin

C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD (copy)

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\hNZdz[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2760287.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4DCE1C90.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\642EEADC.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\988D220B.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9D0EA1B2.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9E522104.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9EEE011E.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B771952D.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DCE8D351.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\ED2C6F4F.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FCB74535.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{05894FFF-9B10-4445-B3AA-6E03C6331A8D}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{25683BA2-9842-415F-8B16-690542B9D4B9}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E279F50C-91EA-4841-A527-8D9534FAEB24}.tmp

C:\Users\user\AppData\Local\Temp\{566E8198-3E70-454E-BD79-983511A39AB5}

Windows Analysis Report
Offer 15492024 15602024.docx.doc